paddle-webhooks

name	paddle-webhooks
description	Receive and verify Paddle webhooks. Use when setting up Paddle webhook handlers, debugging signature verification, or handling subscription events like subscription.created, subscription.canceled, or transaction.completed.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Paddle Webhooks

When to Use This Skill

• Setting up Paddle webhook handlers
• Debugging signature verification failures
• Understanding Paddle event types and payloads
• Handling subscription, transaction, or customer events

Verification (core)

Paddle signs every webhook with HMAC-SHA256 over timestamp:rawBody. The Paddle-Signature header is ts=<unix>;h1=<hex> (multiple h1= values appear during secret rotation). Pass the raw request body — don't JSON.parse first.

The official @paddle/paddle-node-sdk exposes paddle.webhooks.unmarshal(rawBody, secretKey, signature) which verifies and parses in one call. For Python (or when not using the SDK), verify manually:

Node:

const crypto = require('crypto');

 () {
   parts = signatureHeader.();
   ts = parts.( p.())?.();
   signatures = parts.( p.()).( p.());
   (!ts || signatures. === )  ;

   expected = crypto
    .(, secret)
    .()
    .();

   signatures.(
    crypto.(.(sig), .(expected))
  );
}